Revoke a key
Withdraw a key for good: it never encrypts or signs again, whatever the cause, and it can never become active again.
Who can do it
A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. On a SaaS deployment the server refuses a platform administrator. The console offers Revoke only to a person who holds the permission to revoke keys, and only on a key the server says can be revoked.
The console, the key management CLI and the Admin SDK all revoke through the key administration service. A second revoke operation exists on the cryptographic service for the RapidAPI marketplace offering: a RapidAPI subscriber revokes a key through it, and it forwards the revocation to the key administration service. It is not reachable through the platform's public entry points, and the console offers no control for it.
Before you start
- An active, expired or suspended key can be revoked. A key is revoked once: an already revoked, archived or pending-destruction key cannot be revoked again, because that would replace the cause it was revoked for.
- Revocation is irreversible. To hold a key during an investigation, suspend it instead.
- Choose the cause carefully. It is not a label: it decides what still works on the key's data.
- Security compromise stops decrypting, verifying, and re-encrypting or re-signing off the key, on every material version.
- Any other cause (algorithm deprecated, administrative, policy violation or regulatory requirement) does not stop those reads; your tenant's lifecycle policy still applies to them and may deny them on its own.
- A key suspended for a security compromise can be revoked only for a security compromise.
Steps
- Open Key Inventory.
- Select Revoke on the key's row, or open the key with View Details and select Revoke at the bottom of its details.
- In Revoke Key, choose the Cause. The dialog then shows, version by version, what that cause does to reads on this key, as the server computes it under your tenant's lifecycle policy.
- Write the Reason. It is recorded in the audit trail against your account and read by whoever audits this revocation later.
- Select Revoke Key.
What you see when it worked
The console says the key has been revoked. The key reads revoked, and its details show the cause, your reason and when it was revoked. Every material version not yet destroyed is revoked with it; a version already revoked for a security compromise keeps that cause. The revocation is recorded in the audit trail.
If you revoked from the key's details, they stay open on the key and now offer Archive, the next step towards destroying it.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| Choose a cause to enable this action. | No cause is selected; there is no default cause | Choose the cause |
| Write a reason to enable this action. | The reason is empty | Write the reason |
| This key is suspended for "Security compromise", so it can only be revoked with the cause: Security compromise. | The key is suspended for a security compromise and you chose a weaker cause | Revoke it for a security compromise |
| Key cannot be revoked in its current state | The key is already revoked, archived or pending destruction, or you lack the permission | To stop a destruction, cancel it instead |
| The server verdict for this key has not loaded; the action stays unavailable until it does. | The console could not read what the cause does to this key | Wait, or select retry in the dialog |
Without the console
| Surface | How |
|---|---|
| Key management CLI | ankasecure-km keys revoke --kid <id> --cause <cause> --reason <text> |
| Admin SDK | KeyOperations.revoke(String kid, RevokeKeyRequest request) |
| API | POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/revoke (operation revokeKey on the key administration service) |
Related
- Key Inventory: what the screen shows and every decision you make on it.
- Key Lifecycle: the tenant policy that decides what a revoked key may still do.